Onion sites have bots and scrapers.

They don't use cloudlfare AFAIK.

They normally use a puzzle that the website generates, or the use a proof of work based capcha. I've found proof of work good enough out of these two, and it also means that the site owner can run it themselves instead of being reliant on cloudflare and third parties.